'%3e%3cpath%20d='M138%2095.6436V147H0V0H138V51.3564H59.3526V95.6436H138Z'%20fill='white'/%3e%3cpath%20d='M208%200V147H150V0H208Z'%20fill='white'/%3e%3cpath%20d='M361%200V51.4292H321.377V147H261.731V51.4292H220V0H361Z'%20fill='white'/%3e%3cpath%20d='M512%200V51.4292H472.939V147H414.139V51.4292H373V0H512Z'%20fill='white'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_1_12'%3e%3crect%20width='512'%20height='147'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Scan results
Duolingo: Language Lessons
AndroidLearn 40+ languages with Duolingo's fun, bite-sized lessons. Practice speaking, reading, listening, and writing with game-like lessons designed by learning experts. Now includes Math, Music, and Chess courses.
Quick Verdict
Best for: Language learners comfortable with ad-supported apps
Not For: You limit apps with session recording tools
What It Means For You
In-app behavior is recorded by a session replay tool, meaning taps and learning activity may be watched in detail. User data is shared with over a dozen ad and analytics companies, including TikTok, Facebook, and Unity Ads, for targeted advertising. Users have limited ability to opt out of this data collection.
Quick Verdict
Best for: Language learners comfortable with ad-supported apps
Not For: You limit apps with session recording tools
What It Means For You
In-app behavior is recorded by a session replay tool, meaning taps and learning activity may be watched in detail. User data is shared with over a dozen ad and analytics companies, including TikTok, Facebook, and Unity Ads, for targeted advertising. Users have limited ability to opt out of this data collection.
Method and Limitations
Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.
Findings (21)
Data Security
7 totalNetwork Security
5 totalCode Security
4 totalPrivacy
4 totalThird-Party Risk
1 totalThird-Party Services
Security Strengths
- ✓Comprehensive backup protection (allowBackup=false)
- ✓Code obfuscation enabled (ProGuard/R8)
- ✓Proper SSL/TLS implementation (no certificate bypass)
- ✓SQL injection protection (Room with parameterized queries)
- ✓Play Integrity API for device attestation
Version diff is on the Developer plan. See developer plans.
Context Tags
Package
com.duolingo
Version
6.63.4 (Build 2278)
Analysis Date
Jan 1, 2026
Was this analysis helpful?
Feedback helps us improve our analysis
Recommendation: Use With Caution
Key Findings
Data Security - 7 findings (2 critical, 1 high, 4 medium)
Network Security - 5 findings (1 high, 4 medium)
Code Safety - 0 findings
Privacy - 4 findings (1 critical, 3 high)
Privacy Concerns
What Data is Collected
Detailed behavioral data is collected about how users interact with the app, including which lessons they complete, how long they spend on each screen, and the specific taps and gestures they make. Session recording technology captures a replay of in-app activity for later review. Crash and performance data is also collected. Device identifiers and usage patterns are gathered for advertising targeting.
Third-Party Data Sharing
Activity data is shared with 14 third-party companies across advertising, analytics, and support:
- FullStory - Records and replays in-app behavior
- Adjust - Tracks where users came from before installing the app
- Firebase Analytics - Monitors how users use the app
- Firebase Crashlytics - Collects crash reports
- IronSource - Ad mediation and delivery
- Unity Ads - Delivers in-app ads
- Vungle - Delivers in-app ads
- ByteDance/TikTok Ads - Serves ads across TikTok properties
- Facebook Audience Network - Serves targeted ads via Facebook
- Facebook SDK - Enables Facebook-based features and ad targeting
- Google Play Services - Platform integration and advertising
- WeChat SDK - Enables WeChat-based social features
- Sentry - Monitors app errors
- Zendesk - Powers in-app customer support
Understanding the Scores
| Score Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 35/100 |
| Data Security | 40/100 |
| Network Security | 70/100 |
| Code Safety | 55/100 |
| Data Collection | 45/100 |
| Data Sharing | 50/100 |
| User Control | 30/100 |
Positive Security Features
- Relies on standard Android platform security defaults only.
Areas for Improvement
- Reduce third-party data sharing. User activity is currently shared with 14 separate companies for advertising and analytics purposes. Limiting sharing to only what is strictly necessary would meaningfully reduce how broadly user data circulates.
- Give users real control. The User Control score of 30/100 reflects that users have very few options to limit what is collected or shared. Providing accessible, in-app privacy controls would give users more control over their own data.
- Improve how personal data is protected within the app. The Data Security score of 40/100 reflects areas where the handling of user data inside the app falls short of current best practices.
About This Analysis
This scorecard is generated from automated static analysis of the app's compiled code and configuration. Findings represent capabilities observed in the app's code as of the scan date.
App Details
| Field | Value |
|---|---|
| App Name | Duolingo: Language Lessons |
| Package ID | com.duolingo |
| Version | 6.63.4 (Build 2278) |
| Platform | Android |
| Scan Date | 2026-01-25 |
Right of Reply
Developer not yet contacted